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Members and other attendees present 


Paul Arnold Deputy Chief Executive Officer 

Emma Bate General Legal Counsel 

Ailsa Beaton Non-executive Director 

David Cooke Non-executive Director 

James Dipple-Johnstone Deputy Commissioner (Operations) 

Elizabeth Denham Information Commissioner (chair) 

Jane McCall Non-executive Director 

Steve Wood Deputy Commissioner (Policy) 

Nicola Wood Non-executive Director 

Amanda Williams Private Secretary to the Information 
Commissioner 

Peter Bloomfield Senior Corporate Governance Manager 
(secretariat) 

Caroline Robinson Corporate Governance Officer 


(secretariat) 


1. Introductions and apologies 
1.1. There were no introductions or apologies. 


2. Declaration of interests 
2.1. There were no declarations of interest. 


3. Matters arising from the previous meeting 


3.1. The minutes were confirmed as accurate. There were no 
outstanding actions. 


4. Commissioner’s introduction 


4.1. The Commissioner highlighted the high workload for all 
ICO staff at present with the countdown to GDPR on 25" May 
getting close. In particular the ICO was developing much new 
guidance on GDPR including sector specific guidance in some 
areas. The ICO was also leading on and inputting into Article 
29 Working Group guidance on GDPR. 


4.2. Additionally, the ICO was working closely with the DCMS 
and wider government on the Data Protection Bill as it moved 
through Parliament. There were issues outstanding which the 
office was taking forward. 


4.3. The ICO had also introduced a data breach hotline and 
an SME helpline; had commissioned four pieces of research 
under its new grants programme; was planning for the new 
fee structure from 25 May; and was taking forward major 
investigations. 


4.4. James Dipple-Johnstone updated the Board on its 
responsibilities under NIS as a competent authority. Funding 
was available and implementation work was ongoing. 


4.5. Paul Arnold updated the Board following the removal of 
the ICO website from service on 11 February. 


Action point: Paul Arnold to report back to Audit 
Committee on any lessons learnt. 


5. Discussion items 


Technology strategy 


5.1. Steve Wood introduced the draft Technology Strategy. 
It set out eight goals supported by the identification of three 
priority areas for the work of the office over 2018/19. The 
strategy would be supported by a new “cyber” goal in the 
Information Rights Strategic Plan and would be taken forward 
by the new Head of Technology. 


5:2.: To provide context a paper entitled “Risks and 
opportunities for information rights arising from technology” 
was also tabled. The Board discussed ways in which the 
information in this paper could be disseminated more widely. 


Action point: Steve Wood to consider how best to 
disseminate information in the paper “Risks and 
opportunities for information rights arising from 
technology”, by the time of the May Management 
Board. 


Action point: Steve Wood to expand the section 
detailing sandboxes in the supporting paper “Risks and 
opportunities for information rights arising from 
technology”. 


5:3: In respect of the ICO itself making better use of 
technology, work in this area was detailed in the Resource 
and Infrastructure Strategy. 


5.4. The Board supported the new Technology Strategy 
which would be finalised and published shortly. 


Budget 2018/19 


5.5. Paul Arnold introduced a draft budget for 2018/19. In 
developing the budget account had been taken of uncertainty 
over pay and staff numbers and the impact of the new 
funding scheme for data protection work. 


Action point: Paul Arnold to consider amendments to 
the budget and to finalise it by the 31 March. 


Funding model 


5.6. Paul Arnold provided a brief update on the new funding 
model. The expectation was that the SI detailing the model 
was to be laid on 20 February and the ICO guidance would be 
launched the same day. 


Action point: Paul Arnold to provide a copy of the ICO 
guidance on the new fee system to the Non-executive 
Directors when it is published. 


Post Brexit planning 


5.7. There was discussion as to the possible role of the ICO 
and the shape of data protection legislation after the UK had 
left the EU. 


. Risk and opportunity management 


6.1. Paul Arnold introduced the risk register, explaining that 
the register and risk assessment were increasingly being 
used to help manage the work of the ICO. 


6.2. This version of the register had come to the recent Audit 
Committee and it represented the impact of decisions on the 
pay case and the progress of the Data Protection Bill through 
Parliament. The highest priority currently was the opportunity 
for the ICO to make real changes to its culture. 


6.3. There was discussion on the wording of risks in the 
areas of workforce development and the capacity to increase 
staff numbers and train new staff. 


Paul Arnold to review risks in the area of workforce 
development and to update the register accordingly by 
20 April. 


7. Performance against the Information Rights Strategic Plan and 
the Resource and Infrastructure Strategy 


Zi: The quarterly report on performance against the 
Information Rights Strategic Plan was presented for 
discussion. The paper highlighted the broad range of work 
being done at the ICO. James Dipple-Johnstone explained 
how the Operations Directorate was able to move resources 
to meet changing priorities. 


7:2; There was discussion as to the best way of showing 
performance with the need to better highlight key successes 
identified, and the inclusion of information on speeches, 
blogs, engagement and Parliamentary involvement. Executive 
members of the Board could also speak to the work of their 
Directorates. 


7:3: Paul Arnold also introduced a quarterly report on 
performance of the DCEO Directorate which included the 
setting up of the SME helpline which had received calls from 
10,000 people. 


8. Finance 


8.1. Paul Arnold advised that ICO notification fee income was 
7% up on last year. 


8.2. There had been an advance from the DCMS to allow the 
ICO to prepare for GDPR implementation and DCMS had also 
provided financial cover for work to re-furbish the new 
accommodation. 


9. Any other business 


9.1. It was confirmed that if Non-executive Directors 
received enquiries about information rights issues these could 
be passed to the new Group Manager Private Office once they 
were in post, and in the meantime to Paul Arnold. 


9.2. Information on the pay case was available on the ICO 
web site. 
9.3. The Data Protection Practitioners’ Conference was on 9 


April in Manchester. 


